Security – Jack Scott's Blog

This week I’m at linux.conf.au, the southern hemisphere’s premier open-source conference. This year it is being held in Ballarat, about an hour’s travel from Melbourne. I’ll be documenting the trip and conference as much as I can given the limits of my enthusiasm and awakeness.

Friday 20th January:

Friday is the last day of the conference, and everybody is starting to look tired; it’s a full-on week. But, before we all go home, there are just a few more excellent talks to attend. The first of these was Friday’s keynote, given by Jacob Appelbaum, and what an amazing keynote it was. Jacob talked about the state of surveillance states. He explained what they are doing to keep track of all of their citizens, and the special measures that have been put in place in the last few years (mostly since September 11) that significantly curtail our freedoms in the name of privacy and safety. A few choice quotes from the talk:

Free software is for freedom, open source is for business solutions.

Be the trouble you want to see in the world. [It’s in my notes, but I’m pretty sure it was actually just written on his shirt]

90s Nihilism: I have nothing to hide.

The data kept about you in [server] logs around the world tells a story that is not necessarily true, but is made up of facts.

This talk flowed on nicely from Senator Ludlam’s talk at the Penguin dinner.

After morning tea, I watched the talk by Rusty Russell and Matt Evans about why UNIX has been getting bigger over time (in terms of binary bloat). It’s mostly due to new features, but also because of the infrastructure that modern systems have and the libraries that are statically linked in these days (glibc is basically just bloatware). Also in this session I attended the talk by Simon Horman on Open vSwitch. It’s really interesting content, but the presentation was a bit dry. It’s definitely something I want to check out when I get home though, as it could be quite useful for me when I have VMs set up in Linux. The support for VLANs makes it a much better choice than standard Linux network bridges.

During lunchtime there was a meeting between a group of Tasmanian delegates, and it was decided that the Hobart Linux User’s Group should be started up again. So if you’re reading this, like Linux and live in Hobart, get in touch!

After lunch was the best-of sessions. These were talks voted for by the delegates that they wanted to see again, or missed the first time around. I watched two fabulous talks. The first was on Codec2 (presented by David Rowe), an audio speech codec that uses 1400 bits/sec for transmission, which is a 500x improvement on raw 16bit 44.1kHz audio. Very impressive. The second was on the freedom box project (presented by Bdale Garbee, which is a platform for developing easy-to-use home servers oriented towards federated social networking services (such as Status.net or Diaspora). This followed on nicely from Appelbaum’s talk that morning, giving a solution to some of the problems that were outlined.

The final session of the conference was the lightning talks. The real highlight was watching Paul Fenwick jump up on stage between the lightning talks and try to give a several minute long presentation in thirty seconds. He failed, but it was funny to watch. After the lightning talks was the closing ceremony. The main reason for this is to hand out a few awards and thank some people, but also to find out where the next linux.conf.au is going to be held. Next year, it’s in Canberra!

Thursday 19th January:

The morning started off with a keynote from Karen Sandler, Executive Director of the GNOME Foundation. This was a fascinating talk about the dangers behind having proprietary computer systems running our essential services, the things we rely on every day for our modern society. Her biggest example (and an amazingly powerful one) is the pacemaker that runs her heart (or gives it a jolt if it stops, at least). Attackers could quite easily crack into some of the modern pacemakers via the wireless signal they emit, and cause all kinds of damage (like giving a shock when it’s not needed, or failing to give one when it is). In addition, there are all other kinds of things we rely on (voting machines, car control software, etc.) that are closed source and pose a risk to us because of this. So basically it was about how we really need to move to open source systems to make the world a better place, not just because of reliability or business reasons.

Between morning tea and lunch I viewed included a tutorial on setting up a Linux HA cluster using pacemaker (with an example MySQL set-up) which I learned a lot from. I’m going to have to try out the techniques at home more, and see if I can apply them to my systems. I’m not sure how well these practises will work over wide-area networks though, as they’re primarily designed for LANs (as Michael Wheeler said to me, “It’s not redundant until it’s geographically redundant.”).

After lunch was another tutorial, this time on the basics of computer security. There are some crazy things you can do to try and break into a computer. I finally understand how buffer overflows work, and what can be done to prevent them (quite a lot, actually). Breaking into encryption was another strong topic. You can measure how much power a CPU is using to figure out whether it’s doing add or multiply, and things like that. But basically what you really need to do is maintain a much higher consideration of security while coding than you did before, and I hope this tutorial will help me achieve that.

After afternoon tea (during which I consumed a suspiciously large quantity of fruit… I must be craving healthy food) it was time for the talk given by my friend Chris and his friend Paris, titled “Android is not vi”. It’s probably the funniest talk I’ve seen the entire conference, and several delegates have mentioned it wouldn’t be out of place in a comedy routine. The talk was mostly about making the user experience on Android better, but with a surprise ending: the general principles apply to pretty much any user experience design, because they’re all the same. Not making the user think is pretty much the key.

Then of course, Thursday night means the Penguin dinner. This is the opportunity for the speeches and the presentation of the Rusty Wrench award, named after Rusty Russell who started running the conference back in 1999. This year it was given to Mary Gardiner for her services to the Ada Initiative, amongst other things. This is very well deserved too, as there is a nearly 20% female attendance rate at LCA this year. The meal at the dinner was also excellent. I had a pork salad starter, the chicken thigh main, and then an amazing mango cake dessert (pictured). After dinner, we received a speech by Senator Scott Ludlam on the surveillance state that Australia is turning into. 250000+ people have had some sort of police surveillance performed on them in Australia last year. Scary stuff, and I think it will only become scarier once we have heard what Jacob Appelbaum has to say in his keynote tomorrow morning. All in all, a great event.

Tag: Security

linux.conf.au 2012 – Day 5 (Friday)

linux.conf.au 2012 – Day 4 (Thursday)